CVE-2026-20881: Intel QuickAssist Technology DOS Vulnerability

CVE-2026-20881 Overview

CVE-2026-20881 is a divide-by-zero vulnerability [CWE-369] affecting Intel Quickassist Technology (QAT) software drivers for Windows before version 1.13. The flaw resides in Ring 3 user application code paths and allows an authenticated, unprivileged local user to trigger a denial-of-service condition. Successful exploitation impacts availability only, with no effect on confidentiality or integrity. Intel published the issue under advisory Intel-SA-01387. The vulnerability requires no user interaction and has low attack complexity, but the local-only attack vector limits remote exploitability.

Critical Impact

A local authenticated attacker can crash or hang the Intel QAT driver subsystem on Windows, disrupting cryptographic acceleration and compression services that depend on the driver.

Affected Products

• Intel Quickassist Technology (QAT) software drivers for Windows
• All versions prior to 1.13
• Windows systems leveraging QAT user-space libraries for cryptographic or compression offload

Discovery Timeline

• 2026-05-12 - CVE-2026-20881 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-20881

Vulnerability Analysis

The vulnerability is a classic divide-by-zero arithmetic flaw [CWE-369] in the Intel QAT Windows driver components accessible from Ring 3 user applications. When a user-mode application invokes a driver code path with a crafted parameter that ultimately serves as a divisor, the calculation triggers an unhandled arithmetic exception. The resulting fault propagates and produces a denial-of-service condition for the QAT service. Because QAT accelerates cryptographic and compression workloads, downstream applications relying on these offload capabilities lose availability until the driver state is restored. The flaw does not expose memory contents and does not permit modification of system data.

Root Cause

The root cause is missing validation of an operand prior to a division operation in the QAT user-mode driver interface. The code accepts an input value through a Ring 3 entry point without confirming the value is non-zero. When the divisor reaches the arithmetic instruction with a value of zero, the processor raises a #DE (divide error) exception, which the driver does not handle gracefully.

Attack Vector

Exploitation requires local access and valid authentication on the target Windows host. An attacker running with standard user privileges can interact with the QAT driver interface and supply the malformed input. No special internal knowledge of the driver internals is required, and the attacker does not need administrative rights. The attack does not traverse the network and cannot be triggered through remote protocols.

No public proof-of-concept code or exploit is available for CVE-2026-20881. The vulnerability mechanism is documented in Intel Security Advisory SA-01387.

Detection Methods for CVE-2026-20881

Indicators of Compromise

• Unexpected Windows Event Log entries indicating QAT driver faults, service restarts, or arithmetic exceptions originating from QAT user-mode libraries
• Repeated crashes of processes that consume QAT acceleration APIs, such as TLS terminators or compression services
• Sudden drops in cryptographic or compression throughput correlating with non-administrative user activity

Detection Strategies

• Monitor process and driver crash telemetry for QAT-related modules and correlate with the originating user context
• Audit invocations of QAT user-mode interfaces by non-privileged accounts that do not have a business justification
• Alert on Windows Error Reporting (WER) entries referencing divide-by-zero exceptions in QAT driver components

Monitoring Recommendations

• Centralize Windows Event Log and WER telemetry from systems running Intel QAT drivers into a SIEM for cross-host correlation
• Track QAT service availability metrics and alert on unscheduled service stops or restarts
• Establish a baseline of legitimate QAT API consumers and flag deviations from that baseline

How to Mitigate CVE-2026-20881

Immediate Actions Required

• Inventory all Windows systems running Intel QAT software drivers and identify versions prior to 1.13
• Update Intel QAT Windows drivers to version 1.13 or later as supplied through Intel-SA-01387
• Restrict local logon and interactive access on hosts running QAT acceleration to reduce the population of users capable of triggering the flaw

Patch Information

Intel addressed the vulnerability in Intel QAT software drivers for Windows version 1.13. Refer to Intel Security Advisory SA-01387 for download links, supported platform details, and vendor guidance. Apply the update through standard change management and validate that dependent cryptographic and compression services resume normal operation after the upgrade.

Workarounds

• Limit access to the QAT driver interface by tightening local user permissions on affected Windows hosts
• Where QAT acceleration is not required, disable the QAT driver or service until the patched version can be deployed
• Apply application allow-listing to prevent untrusted binaries from invoking QAT user-mode APIs

# Verify installed Intel QAT driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*QuickAssist*" } | Select-Object DeviceName, DriverVersion